> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jojapi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-factor authentication

> Protect your JoJ API sign-in with a code from an authenticator app, plus single-use recovery codes.

> This article is for everyone with a JoJ API account. Two-factor authentication protects how you sign in; API keys and management tokens are not affected.

With two-factor authentication on, signing in takes two steps: your password, or your Google, GitHub or LinkedIn account, and then a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in without your phone.

## Turn it on

1. Open [Settings › Security](https://jojapi.com/settings/security) and select **Set up** next to **Authenticator app**.
2. Scan the QR code with an authenticator app such as Google Authenticator, 1Password, Authy or Microsoft Authenticator. On a phone, select **Open in your authenticator app**, or type the key by hand.
3. Enter the 6-digit code the app shows. Two-factor authentication is on from this moment.
4. Save your 10 recovery codes: copy or download them and keep them somewhere safe, such as a password manager. They are shown only once.

We email you when two-factor authentication is turned on or off, when a recovery code is used to sign in, and when too many incorrect codes pause the code checks.

## Signing in

After your password, or after Google, GitHub or LinkedIn sends you back, enter the current code from your app. Codes change every 30 seconds, and each code works only once.

* **5 tries per sign-in.** After 5 incorrect codes, sign in again from the start.
* **5 minutes.** The code step expires after 5 minutes.
* **A pause after many incorrect codes.** Too many incorrect codes within an hour, for your account or from one network, pause code checks for up to an hour. When this happens to your account we email you: whoever entered the codes got past your password or one of your connected accounts, so change your password if it was not you.

If a code is refused even though you typed it right, check that your phone sets its time automatically: the codes are based on the clock.

## Recovery codes

A recovery code signs you in when you cannot use your phone: on the code step, select **Use a recovery code instead**. Each code works once, and Settings › Security shows how many are left. We email you each time a recovery code is used to sign in.

For a fresh set, select **New codes** and confirm with a code from your app or a recovery code. The old codes stop working at once.

<Warning>
  Recovery codes open your account just like your phone does. Keep them apart from your password and never share them with anyone, including us.
</Warning>

## Turn it off

In Settings › Security, select **Turn off** and confirm with a code from your app or a recovery code. Signing in then asks only for your password or your social login.

## Lost your phone and your recovery codes

[Contact us](https://jojapi.com/contact) from the email address on your account. Once we have verified that the account is yours, we turn two-factor authentication off and email you. Turn it on again with your new phone; you get new recovery codes.

## What stays the same

* **API keys** keep working; requests to APIs never ask for a code.
* **Management tokens** used by your scripts, CI and agents are not affected.
* **Sessions** that are already signed in stay signed in when you turn two-factor authentication on.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.